CVE-2006-1523

CVE-2006-1523 affects the Linux kernel’s RCU signal handling: the __group_complete_signal function in signal.c may allow local DoS due to an unsafe BUG_ON, guarded by siglock while switch_exit_pids() uses tasklist_lock. Affected version cited is kernel 2.6.16 (and possibly other 2.6.x). The conne...

CVE-2025-21896

CVE-2025-21896 affects the Linux kernel fuse readahead path. The issue arose when converting readahead to folios: folio references were dropped after locking, breaking the expected reference on ap->folios during splice operations, risking use-after-free in readpages. The fix reverts to __reada...

CVE-2025-38237

CVE-2025-38237 pertains to the Linux kernel, specifically the media: platform: exynos4-is code path. The issue arises in fimc_is_hw_change_mode(), where camera mode changes occur without waiting for hardware completion, risking data corruption or system hangs if subsequent operations race with ha...

CVE-2025-38295

Consolidated data shows CVE-2025-38295 affects the Linux kernel Amlogic Meson DDR PMU driver (meson_ddr_pmu_create) where smp_processor_id() was used in a preemptible context. This caused kernel warnings during module loading. The root cause is unsafe CPU-ID retrieval in preemptible code; the fix...

CVE-2025-38539

CVE-2025-38539 : Linux kernel tracing fix. When a module loads and adds trace events, it now takes the trace_event_sem for write while adding the event, preventing possible corruption of the ftrace_events list if two modules load simultaneously. The patch also adds a lockdep_assert_held() on the ...

CVE-2025-38666

CVE-2025-38666 is a Linux kernel vulnerability in the Appletalk AARP proxy path. The issue is a use-after-free caused by a race: the aarp_proxy_network path releases aarp_lock, sleeps, re-acquires it, while a concurrent __aarp_expire_timer may remove and free the same aarp_entry, leading to a UAF...

CVE-2026-23247

CVE-2026-23247 is a Linux kernel TCP/TCP options issue that reintroduces port inclusion in the TS offset to mitigate an off-path TCP source port leakage via a SYN-cookie side-channel. The vulnerability is resolved by reverting a previous downgrade of timestamp offsets and performing a single siph...

CVE-2026-43329

CVE-2026-43329 concerns the Linux kernel netfilter flowtable where the maximum number of hardware offload actions for IPv6 was exceeded (17 used vs 16 allowed). The fixes update flow_action_entry_next() to enforce the limit and raise the per-flow action cap from 16 to 24, enabling IPv6 setups to ...

CVE-2026-43383

CVE-2026-43383 affects the Linux kernel’s TCP MD5 signature handling. The root cause is a non-constant-time MAC comparison, enabling potential timing attacks. The vulnerability is addressed by changing the MAC comparison to a constant-time implementation using the appropriate helper function. The...

CVE-2026-46090

CVE-2026-46090 affects the Linux kernel ALSA aloop driver. A use-after-free in loopback_check_format() can occur when playback starts with parameters that no longer match a running capture stream, while a concurrent close may detach or free the runtime. The issue arises after a patch that moved t...

CVE-2026-46093

CVE-2026-46093 affects the Linux kernel mm/vmalloc subsystem. The issue arises because decay_va_pool_node() can be invoked concurrently from two paths—the purge path and the shrinker path via vmap_node_shrink_scan—without proper serialization. This leads to races and potential memory leaks. The d...

CVE-1999-0400

CVE-1999-0400 affects Linux 2.2.0 where running the ldd command on a core file causes a denial of service. The connected documents confirm the affected component (ldd behavior on core files) and the impact (DoS). No explicit root cause, affected versions beyond Linux 2.2.0 are not detailed here, ...

CVE-2001-1397

CVE-2001-1397 affects the System V shared memory implementation in the Linux kernel before version 2.2.19. The issue allows attackers to modify recently freed memory within SYSV shared memory. Public sources consistently describe this as a kernel memory handling flaw rather than a user-space vuln...

CVE-2002-1976

CVE-2002-1976 affects Linux kernel 2.2+ where ifconfig fails to report when an interface is in promiscuous mode if activated via PACKET_MR_PROMISC, potentially allowing an attacker with local access to sniff network traffic without detection. The vulnerability description is supported by multiple...

CVE-2002-2254

The CVE describes a vulnerability in the Linux kernel’s Netfilter/IPTables: the experimental IP packet queuing feature in kernels 2.4 (up to 2.4.19) and 2.5 (up to 2.5.31). If a privileged process exits while traffic is not queued, a later process with the same PID may access network traffic that...

CVE-2004-0424

CVE-2004-0424 involves an integer overflow in the Linux kernel’s ip_setsockopt handling of the MCAST_MSFILTER socket option. Affected ranges are Linux kernel 2.4.22–2.4.25 and 2.6.1–2.6.3. The vulnerability allows local users to cause a crash (denial of service) or potentially execute arbitrary c...

CVE-2004-0626

The CVE-2004-0626 issue affects the Linux kernel 2.6 netfilter subsystem when using iptables with TCP options. Affected code path is tcp_find_option; a large option length can produce a negative value after casting to char, causing an infinite loop that consumes CPU and leads to remote DoS. This ...

CVE-2005-0207

CVE-2005-0207 corresponds to an unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x where NFS clients can trigger a denial of service via NFS client O_DIRECT error handling. The issue is documented in multiple advisories (RHSA-2005:366 / CESA-2005:366) and CentOS/Ubuntu/NVD entries. Aff...

CVE-2005-1589

The CVE-2005-1589 issue affects the Linux kernel’s pktcdvd (and raw device) ioctl handler. In kernel 2.6.12-rc4 and earlier, pkt_ioctl in pktcdvd.c calls the wrong function when issuing an ioctl to the block device, which can leak kernel address space to user space. This local-privilege scenario ...

CVE-2005-2617

The CVE-2005-2617 entry describes a vulnerability in Linux kernel 2.6.12 and later on 64-bit x86 where syscall32_setup_pages (syscall32.c) does not check the return value of insert_vm_struct. This can allow local users to trigger a memory leak via a crafted 32‑bit ELF header. Affected component: ...

CVE-2005-2708

CVE-2005-2708 details: a flaw in Linux 2.4 kernel on 64‑bit x86 where exec.c’s search_binary_handler fails to check a return code under low virtual memory, enabling local users to trigger a denial of service (panic). Public discussions in Ubuntu/Bash contexts confirm the issue affects 64‑bit x86,...

CVE-2005-3623

CVE-2005-3623 affects Linux kernel 2.6.14.4, where nfs2acl.c does not check MAY_SATTR before setting ACLs on files on exported NFS filesystems. This flaw can allow remote attackers to bypass ACLs on readonly-mounted NFS exports. The issue is addressed in kernel security updates (e.g., RHSA-2006:0...

CVE-2005-4351

CVE-2005-4351 – Summary (concrete details from connected docs): The vulnerability affects BSD Securelevels implementations in FreeBSD (up to 6.0-STABLE and 7.0-CURRENT), OpenBSD (up to 3.8), DragonFly (up to 1.2), and Linux (up to 2.6.15). The root cause is that, while securelevels protect files ...

CVE-2006-0096

CVE-2006-0096 affects the SDLA driver in Linux kernels 2.6.x before 2.6.11 and 2.4.x before 2.4.29, describing lax capability checks for firmware upgrades. The description notes local attack vectors and an unclear impact; later investigation mentions that exploitation may require root privileges ...

CVE-2006-0555

Vulnerability: CVE-2006-0555 affects the Linux kernel prior to 2.6.15.5, where NFS client operations using O_DIRECT can cause the kernel to panic and crash (local denial of service). Affected product is the Linux kernel; root cause relates to direct I/O handling for NFS. Public advisories from Re...

CVE-2007-3732

The CVE-2007-3732 issue affects Linux 2.6 up to before 2.6.23, involving the TRACE_IRQS_ON function in iret_exc. The root cause is calling a C function without ensuring that processor segments are correctly set, specifically failing to restore the kernel %fs before the call and before enabling in...

CVE-2009-4410

The CVE-2009-4410 issue affects the Linux kernel 2.6.29-rc1 through 2.6.30.y, specifically the fuse_ioctl_copy_user path in fs/fuse/file.c. The bug stems from using the wrong variable as an argument to kunmap in the ioctl handler, enabling local users to trigger a denial of service (panic) via un...

CVE-2016-8400

CVE-2016-8400 describes an information-disclosure vulnerability in the NVIDIA librm library (libnvrm) on Android (Kernel 3.18). A local malicious application could read data outside its permission levels due to improper memory handling in LIBNVRM, potentially exposing sensitive data. The vulnerab...

CVE-2016-8412

CVE-2016-8412 is an elevation-of-privilege vulnerability in the Qualcomm camera that could allow a local malicious app to execute arbitrary code in the kernel context. The issue affects Android kernel versions 3.10 and 3.18 and is rated High because exploitation requires first compromising a priv...

CVE-2017-0331

CVE-2017-0331 (NVIDIA Tegra kernel driver, NVMAP): An elevation-of-privilege/DoS issue where untrusted data can change between validation and use, potentially allowing a local attacker to escalate privileges or cause kernel-state impact. Affected context references Android on kernel 3.10 and the ...

CVE-2017-0435

CVE-2017-0435 is an elevation-of-privilege in the Qualcomm sound driver affecting Android kernels (Kernel-3.10 and Kernel-3.18). The vulnerability could let a local malicious app execute arbitrary code in the kernel context after compromising a privileged process. The CVE is documented with Qualc...

CVE-2017-0463

CVE-2017-0463 is an elevation-of-privilege in the Qualcomm networking driver affecting Android kernels (Kernel-3.10 and Kernel-3.18). The issue could let a local malicious app run code in kernel context after compromising a privileged process. The available connected sources confirm the vulnerabi...

CVE-2017-0518

Summary: CVE-2017-0518 is an elevation of privilege in the Qualcomm fingerprint sensor driver on Android, enabling a local attacker to execute arbitrary code in kernel context. The affected component is the Qualcomm fingerprint sensor driver (kernel version 3.18 on Android). The issue requires co...

CVE-2017-0564

CVE-2017-0564 relates to an Elevation of Privilege in the Android kernel ION subsystem. The issue could allow a local malicious app to execute code with kernel privileges (local EoP). Affected are Android kernels 3.10 and 3.18. Public documents identify the kernel ION subsystem as the vulnerable ...

CVE-2017-8066

Affected software/component: Linux kernel drivers/net/can/usb/gs_usb.c in 4.9.x and 4.10.x prior to 4.10.2. Root cause: Interaction with CONFIG_VMAP_STACK allows a local attacker to cause a denial of service or memory corruption by leveraging multiple virtual pages for a DMA scatterlist. Impact: ...

CVE-2022-48897

CVE-2022-48897 affects the Linux kernel arm64 memory management, specifically a bug where pmd_leaf could be considered valid even when the PMD is invalid due to pmd_present_invalid. This caused file_map_count to be decremented and then incremented in multiple code paths, ultimately triggering a B...

CVE-2022-49018

CVE-2022-49018 involves a Linux kernel bug where a sleep in atomic context occurred during mptcp_close. The CVE entries in the provided documents confirm the issue was resolved by replacing the fast socket lock variant with sock_lock_nested() in the mptcp_close path (net/mptcp/protocol.c: close f...

CVE-2022-49500

CVE-2022-49500 concerns the wl1251 DMA memory handling in the Linux kernel. With the switch to vmap’ed stacks, stack parameters can no longer be used for DMA, which could trigger a kernel panic at multiple wl1251 locations (e.g., via SDIO), rendering devices like OpenPandora unusable. The fixed a...

CVE-2022-49820

CVE-2022-49820 concerns the Linux kernel mctp i2c flow release logic. The issue arises when release_count > i2c_lock_count, triggering a WARN_ONCE due to expiring a flow before sending the first packet and not pairing the release increment with the i2c lock operation. The fix adds a guard: onl...

CVE-2022-49895

CVE-2022-49895 concerns the Linux kernel fix for a NULL pointer dereference in the cxl/region path. When an intermediate port’s decoders are exhausted and a new region is added in its hierarchical path, cxl_port_attach_region() may fail to find a port decoder and fall through to cleanup. During t...

CVE-2022-50014

CVE-2022-50014 is a Linux kernel issue resolved by removing FOLL_COW and tightening COW handling in mm/gup. The advisories state that FOLL_FORCE could cause a read-only, shared page to become writable, enabling local exploitation similar to Dirty COW, particularly via exclusive anonymous pages an...

CVE-2023-20661

CVE-2023-20661 affects the wlan component (MediaTek-related stack) and is caused by an out-of-bounds write resulting from an integer overflow. The vulnerability can lead to local privilege escalation with System execution privileges required and does not require user interaction. Reported impact ...

CVE-2025-21777

CVE-2025-21777 affects the Linux kernel ring-buffer metadata validation. The vulnerability stems from the subbuf index array (reader page and subbuffer order) potentially containing duplicates, which the validator did not check. If duplicates exist on the writer side, the ring buffer link list co...

CVE-2025-38207

CVE-2025-38207 : In the Linux kernel, a bug in the uprobe handling during vma expansion could cause the upnode page table entry (pte) to be overwritten, potentially orphaning the upbump page. The issue arises when remapping a vma that includes an uprobe, causing a pte overwrite during the set_pte...

CVE-2025-38261

CVE-2025-38261 affects the Linux kernel on riscv: the SR_SUM state must be saved/restored across task switches to prevent crashes under heavy load. The issue stems from put_user() in schedule_tail potentially clearing SR_SUM when a sleeping function is involved, risking kernel memory access fault...

CVE-2025-38270

CVE-2025-38270: In the Linux kernel, netdevsim with netpoll could trigger a napi_complete-related issue if napi_complete() is called from netpoll. The fix disables napi_complete() in netpoll paths for netdevsim to prevent premature SCHED state handling, addressing a warning observed in napi_compl...

CVE-2025-38278

CVE-2025-38278 affects the Linux kernel’s octeontx2-pf traffic shaper (TC_HTB_LEAF_DEL_LAST callback). The patch refactors the callback to stop active leaf-node traffic before reassigning its send queue to the parent and to handle reboot scenarios where TC_HTB_LEAF_DEL and TC_HTB_LEAF_DEL_LAST ma...

CVE-2025-38321

CVE-2025-38321 affects the Linux kernel SMB/CIFS code. Under low-memory conditions, close_all_cached_dirs may fail to move dentries for dput(), causing a Dentry still in use error; an explicit error message was added to make this condition clear. The fix also short-circuits the tcon allocation lo...

CVE-2025-38413

The CVE-2025-38413 issue relates to virtio-net: xsk: rx length checking in the Linux kernel. The problem was that buf_to_xdp validated len using xsk_pool_get_rx_frame_size() + vi->hdr_len, but the first buffer for virtio headers can only contain xsk_pool_get_rx_frame_size() bytes. The fix intr...

CVE-2025-38512

Intel/summary (CVE-2025-38512) The Linux kernel patch for wifi A-MSDU spoofing in mesh networks fixes a vulnerability where an A‑MSDU could be incorrectly parsed as a standard MSDU. The mitigation detects this by parsing a received A‑MSDU as MSDU, computing the Mesh Control header length, and ver...